commit de25e307c4535f700bfd7e38fafa3f5076cb1038
author TreeHugger Robot <treehugger-gerrit@google.com> Sat Jun 19 01:28:52 2021 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Sat Jun 19 01:28:52 2021 +0000
tree 8ffc227a8445bd266829081b9033013e5c706194
parent ed10b9c9773a36ca5f007c701e3624cf9024f6ed
parent 023c5c37ea619af414267bf7a4efbd8eb066397c

Merge "Allow shell to read /vendor/apex/*" into sc-dev

prebuilts/api/31.0/private/shell.te

diff --git a/prebuilts/api/31.0/private/shell.te b/prebuilts/api/31.0/private/shell.te
index 1dda977..40b19fd 100644
--- a/prebuilts/api/31.0/private/shell.te
+++ b/prebuilts/api/31.0/private/shell.te
@@ -114,8 +114,10 @@
 allow shell self:perf_event { open read write kernel };
 neverallow shell self:perf_event ~{ open read write kernel };
 
-# Allow shell to read /apex/apex-info-list.xml
+# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
 allow shell apex_info_file:file r_file_perms;
+allow shell vendor_apex_file:file r_file_perms;
+allow shell vendor_apex_file:dir r_dir_perms;
 
 # Set properties.
 set_prop(shell, shell_prop)

private/shell.te

diff --git a/private/shell.te b/private/shell.te
index 1dda977..40b19fd 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -114,8 +114,10 @@
 allow shell self:perf_event { open read write kernel };
 neverallow shell self:perf_event ~{ open read write kernel };
 
-# Allow shell to read /apex/apex-info-list.xml
+# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
 allow shell apex_info_file:file r_file_perms;
+allow shell vendor_apex_file:file r_file_perms;
+allow shell vendor_apex_file:dir r_dir_perms;
 
 # Set properties.
 set_prop(shell, shell_prop)